A Security Situational Awareness System Based on Industrial Control Network Traffic

Abstract

The invention discloses a security situation awareness system based on industrial control network traffic, which is characterized in that the security situation awareness system includes: an industrial control network traffic collection module (10), a network traffic proxy forwarding module (20), and a traffic data storage module (30), abnormal detection module (40), configuration management module (50), security situation visualization module (60), modeling and algorithm update module (70); the security situation awareness system is conducive to improving the abnormal detection of industrial control network traffic Efficiency and accuracy, improved system availability and scalability.

Description

technical field [0001] The invention relates to a technology of industrial network security situation awareness, in particular to a security situation awareness system based on industrial control network traffic. Background technique [0002] There are various types of industrial control network data, and the amount of data is huge. There are various types of industrial equipment, host computers, controllers and other communication traffic in the network, forming a large amount of redundant data, it is difficult to mine key traffic, and it also has a great impact on the performance of the system. Since most of the data available in the industrial control network is normal data, there is only a very small amount of abnormal data, and there is a serious data imbalance problem. The existing machine learning or deep learning anomaly detection technology is difficult to apply in industrial networks. [0003] In the prior art, the existing network traffic is often modeled. However...

AI Technical Summary

Problems solved by technology

[0004] (1) Low performance: It is difficult to forward, store and query ultra-large-scale industrial control network traffic data, and the system throughput and performance are extremely low;

[0005] (2) Inaccurate: The reliability of the test results fluctuates, making it difficult to deal with unknown abnormal data, which leads to a decrease in the accuracy of the test results;

[0006] (3) Difficult to update: The industrial control environment is a constantly evolving environment. The existing perception system cannot perform abnormal detection and self-update based on the existing detection results, and the customizable configuration items are insufficient.

Images